0

I am working with postfix and dovecot and I can't seem to find out anywhere how to create this setup:

1) allow submission of emails from outside (telnet) where the sender domain is the local server domain and recipient address is anything (not only local recipients)

2) encrypt the protocol

3) create authentication so that before submitting the email to the server via the protocol the client must prove that they are allowed to send emails from it (relay?)

By default postfix runs SMTP on port 25 which I can use to send emails from any address to any address without any encryption or authentication. I don't think that's what I want. Telnet EHLO returns

250-PIPELINING
250-SIZE 104857600
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Then it also runs SMTP on port 587, this one is also open to anyone but it accepts only emails whose recipients have domains identical to the server domain. Again no authentication. Telnet EHLO returns

250-PIPELINING
250-SIZE 104857600
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Additionally, do I understand it correctly that the SMTP submission protocol (587) is used for receiving mail from other servers (and their clients) to my clients (addresses with my domain name)? Or is for this kind of thing used only POP and IMAP? Which of the three SMTP protocols - 25, 465, 587 should I use for this setup?

  • Have you checked postfix EHLO reply after STARTTLS? – AnFi Feb 26 at 3:55
0

Your configuration is twisted; this is how it should be:

  • SMTP on port 25 is for receiving mail from other servers to local recipients without authentication. It should accept unencrypted connections for compatibility, but it's wise to allow encrypted connections with STARTTLS whenever the other server is capable of negotiating encrypted connection.

  • submission on port 587 is for your own users mail user agents (MUA). It should require STARTTLS before authentication and only allow authenticated users to send mail. I recommend using smtpd_sender_login_maps to prevent any user from using any sender address.

While the SMTP on port 25 can accept both connections, it's usually limited on consumer grade internet connections. It's also easier to have separate settings on separate port for these two different scenarios.

The port 465 is for TLS connections. It works similarly as the submission, but the connection starts directly as TLS. Finally, POP3 and IMAP are protocols for reading mail using a MUA, not for email delivery.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.